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DETAILED ACTION 

RESPONSE TO ARGUMENTS 

Applicant's arguments with respect to claim 1 have been considered but are moot in view of the new 
ground(s) of rejection. 

CLAIM REJECTIONS 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-2,4-5, 9-15, 20-21, 26 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Edery, US PGP No. 20020013910 and further in view of Chen, US 
Patent No. 5960170 

As per claim 1, 14, 21, Edery teaches: 

A processor-readable medium comprising processor-executable instructions for: 
parsing an input file to recognize a file format of the input file; 
[see para. 0086] 

checking contents of the input file, according to the recognized file format if available, to determine 
whether executable code exists within the input file; and 

[see para. 0086] 
sending a status in response to results of said checking. 

[see para. 0087] 
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Edery is mute in teaching, "wherein parsing repeatedly parses with a plurality of component parsers 
contained within a compound parser, wherein the compound parser is extensible and each of the plurality 
of component parsers is configured for recognition of a specific file format." 

Chen teaches the above limitation not taught by Edery. In col. 7, lines 20-25, Chen teaches a 
plurality of virus detection objects are produced by the virus detection server and transmitted to 
the client. These objects are viewed by examiner to be analogous to the claimed "component 
parsers." Col. 8, lines 1-5 cite that the objects contain information allowing them to detect the 
type of viruses present at the client based on file type. It would be obvious to one of ordinary skill 
to modify the invention taught by Edery to include that which is taught by Chen so that specific file 
types can be scanned in order to detect multiple types of viruses that may reside on different 
platforms of file types. 

Edery is also mute in teaching "continuing to parse the input file with all remaining component parsers 

after at least one component parser recognizes the file format of the input file." 

Chen teaches the above limitation not taught by Edery. In col. 7, lines 51-60 cite that the 
production of virus detection objects continues until a determination is made in step 245 as to 
whether additional scanning is no longer required. It would be obvious to one of ordinary skill to 
modify the system taught by Edery to include that which is taught above by Chen so, based on 
the results received by the virus detection server, scanning for viruses can continue until a 
desired result is achieved. 

As per claim 2, 15, Edery teaches: 

The processor-readable medium as recited in claim 1, wherein sending a status comprises further 
instructions for: sending a file-has-no-code status when the file format of the input file was recognized and 
no executable code was found; and sending a file-has-code status when executable code was found. 
[see para. 0087] 



As per claim 3, 16, 22, Edery teaches: 
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The processor-readable medium as recited in claim 1, additionally comprising further instructions for 
sending a don't-know status when the file format of the input file was not recognized. 
[see para. 0088] 

As per claim 4, 20, Edery teaches: 

The processor-readable medium as recited in claim 1, wherein parsing the input file comprises further 
instructions for parsing the input file repeatedly with a plurality of component parsers contained within an 
extensible parser. 

[see para. 0092] 

As per claim 5, Edery teaches: 

The processor-readable medium as recited in claim 4, additionally comprising further instructions for 
sending a don't-know status when each of the plurality of component parsers contained within the 
extensible parser fails to recognize sections of the input file. 
[see para. 0092] 

As per claim 9, Edery teaches: 

The processor-readable medium as recited in claim 1, wherein checking contents of the input file 
comprises further instructions for operating a component parser portion of an extensible parser to 
recognize a specific data file format. 
[see para. 0086] 

As per claim 10, 28, Edery teaches: 

The processor-readable medium as recited in claim 1, wherein parsing the input file comprises 
instructions for operating a parser configured to recognize a plurality of file formats. 
[see para. 0086] 

As per claim 11, Edery teaches: 
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The processor-readable medium as recited in claim 1, wherein checking contents of the input file 
comprises further instructions for operation of a compound parser including a plurality of component 
parsers, wherein each of the plurality of component parsers is configured for recognition of a specific file 
format. 

[see para. 0093] 
As per claim 12: 

The processor-readable medium as recited in claim 11, additionally comprising further instructions for 
continuing to parse the input file with all remaining component parsers after at least one component 
parser recognizes the file format of the input file. 

Chen teaches the above limitation not taught by Edery. In col. 7, lines 51-60 cite that the 
production of virus detection objects continues until a determination is made in step 245 as to 
whether additional scanning is no longer required. It would be obvious to one of ordinary skill to 
modify the system taught by Edery to include that which is taught above by Chen so, based on 
the results received by the virus detection server, scanning for viruses can continue until a 
desired result is achieved. 

As per claim 13, Edery teaches: 

The processor-readable medium as recited in claim 11, additionally comprising further instructions for 
parsing the input file until a component parser recognizes the file format of the input file. 
[see para. 0092] 

As per claim 26, Edery teaches: 

The apparatus as recited in claim 21 , additionally configured to send the status to: a firewall; a host 
intrusion detector; or a host vulnerability assessor. 
[see para. 0047] 



Application/Control Number: 10/769,106 
Art Unit: 2136 



Page 6 



As per claim 6-8, 17-19, 23-25, 27, Edery teaches: 

The processor-readable medium as recited in claim 1, wherein sending the status comprises further 
instructions for sending the status to an email program/instant messaging program/internet browsing 
program. 

Edery teaches alerting one or more users/administrators but does not specifically mention whether said 
alert is sent via email, IM, or browser. Depending on the user's capabilities, examiner interprets that it 
would have been obvious to send said alert via any of the above applications or any other applicable 
application. Examiner further interprets that this is merely a design choice and a certain user system's 
functionality. 

As per claim 29: 

The apparatus as recited in claim 21, wherein the compound parser is configured to allow extension by 
addition of a new component parser to the compound parser, wherein the new component parser 
recognizes a further file format and recognizes executable code within the further file format. 

Chen teaches the above limitation not taught by Edery. In col. 7, lines 20-25, Chen teaches a 
plurality of virus detection objects are produced by the virus detection server and transmitted to 
the client. These objects are viewed by examiner to be analogous to the claimed "component 
parsers. " Col. 8, lines 1-5 cite that the objects contain information allowing them to detect the 
type of viruses present at the client based on file type. It would be obvious to one of ordinary skill 
to modify the invention taught by Edery to include that which is taught by Chen so that specific file 
types can be scanned in order to detect multiple types of viruses that may reside on different 
platforms of file types. 
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Claims 3, 16, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable over 

Edery and Chen as applied to claim 1 above, and further in view of Cover, US PGP No. 

20060136389. 

As per claim 3, 16, 22: 

Both Edery and Chen are mute in teaching: 

The processor-readable medium as recited in claim 1, additionally comprising further instructions for 
sending a don't-know status when the file format of the input file was not recognized. 

The Cover reference teaches in paragraph 0108 a routine to notify a user of an "unknown file type". It 
would have been obvious to one of ordinary skill in the art to utilize this routine with the combination of the 
Edery and Chen references above so that when the system encounters an unknown file type while 
parsing an input file, the user can be alerted so that further action may be taken, such as quarantining the 
file. 

CONCLUSION 

1 . Applicant's amendment necessitated the new ground(s) of rejection presented in this Office 
action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of 
the extension of time policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS from 
the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date 
of this final action and the advisory action is not mailed until after the end of the THREE-MONTH 
shortened statutory period, then the shortened statutory period will expire on the date the advisory action 
is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later than SIX 
MONTHS from the date of this final action. 
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POINTS OF CONTACT 



Any response to this Office Action should be faxed to (571 ) 273-8300 or mailed to: 

Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Hand-delivered responses should be brought to 

Customer Service Window 
Randolph Building 
401 Dulany Street 
Alexandria, VA 22314 

Any inquiry concerning this communication or earlier communications from the examiner should 
be directed to Daniel L. Hoang whose telephone number is 571-270-1019. The examiner can normally 
be reached on Monday - Thursday, 8:00 a.m. - 5:00 p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 

Nasser Moazzami can be reached on 571-272-4195. The fax phone number for the organization where 

this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application maybe obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be 
obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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/Nasser G Moazzami/ 

Supervisory Patent Examiner, Art Unit 2136 



